How to check the logs of registry change from event viewer

Azure 0 Reputation points

I was unable to RDP to azure vm and getting RDP 3 line error

When I ran rdpsettings from Run command in azure portal found the registry value of "fdenytsconnections" as 1 and it needs to be 0. Changed value to 0 and able to RDP now.

I need to know who changed the registry value. When I googled it 4657 is the event id for registry modification. When I checked it in security logs, did not find any logs.

Please help me finding who made the change.

Azure Virtual Machines
Azure Virtual Machines
An Azure service that is used to provision Windows and Linux virtual machines.
7,392 questions
{count} votes